Skip to content

Commit deb3dda

Browse files
TaofeeqibTaofeeqib
committed
DevSecOps test
1 parent 8fdd6af commit deb3dda

28 files changed

Lines changed: 762 additions & 1005 deletions

‎.github/workflows/devsecops-pipeline.yml‎

Lines changed: 24 additions & 405 deletions
Large diffs are not rendered by default.

‎.github/workflows/scripts/check-sca-results.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
3+
# Function to create placeholder SARIF file for dependency check
4+
function create_dependency_check_placeholder() {
5+
echo '{
6+
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
7+
"version": "2.1.0",
8+
"runs": [
9+
{
10+
"tool": {
11+
"driver": {
12+
"name": "OWASP Dependency-Check",
13+
"version": "placeholder",
14+
"rules": []
15+
}
16+
},
17+
"results": []
18+
}
19+
]
20+
}' > ./docs/reports/dependency-check-placeholder.sarif
21+
}
22+
23+
echo "Checking if SARIF files exist in docs/reports directory"
24+
if [ -d "./docs/reports" ]; then
25+
ls -la ./docs/reports/
26+
echo "Found files in docs/reports directory"
27+
sarifCount=$(find ./docs/reports -name "*.sarif" | wc -l)
28+
29+
if [ "$sarifCount" -gt 0 ]; then
30+
find ./docs/reports -name "*.sarif" | while read file; do
31+
echo "Found SARIF file: $file"
32+
echo "File contents (first 20 lines):"
33+
head -n 20 "$file"
34+
done
35+
else
36+
echo "No SARIF files found in docs/reports directory. Creating placeholder."
37+
create_dependency_check_placeholder
38+
fi
39+
else
40+
echo "Reports directory does not exist!"
41+
mkdir -p ./docs/reports
42+
create_dependency_check_placeholder
43+
fi

‎.github/workflows/scripts/commit-reports.sh‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
3+
# Configure git
4+
git config --local user.email "github-actions[bot]@users.noreply.github.com"
5+
git config --local user.name "github-actions[bot]"
6+
7+
# Set merge strategy to avoid conflicts prompt
8+
git config pull.rebase false
9+
10+
# Fetch latest changes from remote
11+
echo "Fetching latest changes from remote..."
12+
git fetch origin ${GITHUB_REF_NAME}
13+
14+
# Check for changes in remote and merge if needed
15+
echo "Checking for updates from remote..."
16+
git pull origin ${GITHUB_REF_NAME} --strategy-option theirs || echo "Failed to pull, proceeding anyway"
17+
18+
# Ensure docs/reports directory exists
19+
mkdir -p ./docs/reports/
20+
21+
# Stage the changes
22+
echo "Adding report files to git..."
23+
git add ./docs/reports/
24+
25+
# Verify changes were staged
26+
git status
27+
28+
# Check if there are changes to commit
29+
if git diff --staged --quiet; then
30+
echo "No changes to commit"
31+
else
32+
# Commit the changes
33+
echo "Committing report files..."
34+
git commit -m "Add security scan reports [skip ci]"
35+
36+
# Handle potential conflicts during push
37+
echo "Pushing changes to the repository..."
38+
git push origin ${GITHUB_REF_NAME} || {
39+
# If push failed, try pull and merge again
40+
echo "Push failed, attempting to merge remote changes and retry..."
41+
git pull origin ${GITHUB_REF_NAME} --strategy-option theirs
42+
# Try push again
43+
git push origin ${GITHUB_REF_NAME} || echo "Failed to push after merge attempt"
44+
}
45+
46+
echo "Reports have been committed and pushed to the repository."
47+
echo "View them at: https://github.com/${GITHUB_REPOSITORY}/tree/${GITHUB_REF_NAME}/docs/reports"
48+
fi

‎.github/workflows/scripts/copy-artifacts.sh‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/bash
2+
3+
mkdir -p ./docs/reports
4+
5+
echo "Copying all artifacts to docs/reports directory..."
6+
7+
# TruffleHog results
8+
if [ -d "./artifacts/trufflehog-results" ]; then
9+
echo "Found TruffleHog results"
10+
cp ./artifacts/trufflehog-results/* ./docs/reports/ || echo "No TruffleHog files to copy"
11+
else
12+
echo "No TruffleHog results directory found"
13+
fi
14+
15+
# CodeQL results
16+
if [ -d "./artifacts/codeql-results" ]; then
17+
echo "Found CodeQL results"
18+
cp ./artifacts/codeql-results/* ./docs/reports/ || echo "No CodeQL files to copy"
19+
else
20+
echo "No CodeQL results directory found"
21+
fi
22+
23+
# SCA results
24+
if [ -d "./artifacts/sca-results" ]; then
25+
echo "Found SCA results"
26+
cp ./artifacts/sca-results/* ./docs/reports/ || echo "No SCA files to copy"
27+
else
28+
echo "No SCA results directory found"
29+
fi
30+
31+
# SBOM results
32+
if [ -d "./artifacts/angular-xss-sbom" ]; then
33+
echo "Found SBOM results"
34+
cp ./artifacts/angular-xss-sbom/* ./docs/reports/ || echo "No SBOM files to copy"
35+
else
36+
echo "No SBOM results directory found"
37+
fi
38+
39+
# ZAP results
40+
if [ -d "./artifacts/zap-reports" ]; then
41+
echo "Found ZAP results"
42+
cp ./artifacts/zap-reports/* ./docs/reports/ || echo "No ZAP files to copy"
43+
else
44+
echo "No ZAP results directory found"
45+
fi
46+
47+
# Verify copied files
48+
echo "Files in docs/reports directory after copying artifacts:"
49+
ls -la ./docs/reports/
50+
51+
# Run verification script to check for required reports
52+
echo "Running verification script..."
53+
chmod +x ./verify-reports.sh
54+
./verify-reports.sh

‎.github/workflows/scripts/copy-zap-reports.sh‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/bash
2+
3+
# Function to create ZAP XML placeholder
4+
function create_zap_xml_placeholder() {
5+
echo '<?xml version="1.0" encoding="UTF-8"?>' > ./docs/reports/zap-baseline-report.xml
6+
echo '<OWASPZAPReport version="2.11.0" generated="2025-09-07T12:00:00">' >> ./docs/reports/zap-baseline-report.xml
7+
echo ' <site name="http://localhost:4200">' >> ./docs/reports/zap-baseline-report.xml
8+
echo ' <alerts></alerts>' >> ./docs/reports/zap-baseline-report.xml
9+
echo ' </site>' >> ./docs/reports/zap-baseline-report.xml
10+
echo '</OWASPZAPReport>' >> ./docs/reports/zap-baseline-report.xml
11+
}
12+
13+
# Function to create ZAP JSON placeholder
14+
function create_zap_json_placeholder() {
15+
echo '{' > ./docs/reports/zap-baseline-report.json
16+
echo ' "site": "http://localhost:4200",' >> ./docs/reports/zap-baseline-report.json
17+
echo ' "generated": "2025-09-07T12:00:00",' >> ./docs/reports/zap-baseline-report.json
18+
echo ' "version": "2.11.0",' >> ./docs/reports/zap-baseline-report.json
19+
echo ' "alerts": []' >> ./docs/reports/zap-baseline-report.json
20+
echo '}' >> ./docs/reports/zap-baseline-report.json
21+
}
22+
23+
echo "Looking for ZAP Baseline Scan report files..."
24+
25+
# Check in /tmp/zap-output where we directed ZAP to write reports
26+
echo "Checking in /tmp/zap-output:"
27+
ls -la /tmp/zap-output || echo "Directory not found"
28+
29+
# Try to copy from our specific ZAP output directory first
30+
if [ -d "/tmp/zap-output" ]; then
31+
echo "Copying reports from /tmp/zap-output:"
32+
cp -v /tmp/zap-output/*.* ./docs/reports/ 2>/dev/null || echo "No files to copy from /tmp/zap-output"
33+
fi
34+
35+
# Look for baseline scan reports only
36+
for report in \
37+
./zap-baseline-report.xml \
38+
./zap-baseline-report.json \
39+
./report_json.json \
40+
./report_xml.xml \
41+
./report_html.html \
42+
./report_md.md \
43+
/tmp/zap-output/zap-baseline-report.xml \
44+
/tmp/zap-output/zap-baseline-report.json \
45+
/tmp/zap-baseline-report.xml \
46+
/tmp/zap-baseline-report.json \
47+
/zap/wrk/zap-baseline-report.xml \
48+
/zap/wrk/zap-baseline-report.json; do
49+
if [ -f "$report" ]; then
50+
echo "Found report: $report"
51+
cp -v "$report" ./docs/reports/
52+
fi
53+
done
54+
55+
# If no reports were found, create placeholders
56+
if [ ! -f "./docs/reports/zap-baseline-report.xml" ] && [ ! -f "./docs/reports/zap-baseline-report.json" ]; then
57+
echo "Creating placeholder for ZAP baseline reports (XML and JSON)"
58+
create_zap_xml_placeholder
59+
create_zap_json_placeholder
60+
fi
61+
62+
# Check if any reports were copied or created
63+
echo "Contents of docs/reports directory:"
64+
ls -la ./docs/reports/

‎.github/workflows/scripts/find-sca-sarif.sh‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/bash
2+
3+
# Function to create placeholder SARIF file
4+
function create_dependency_check_placeholder() {
5+
echo '{
6+
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
7+
"version": "2.1.0",
8+
"runs": [
9+
{
10+
"tool": {
11+
"driver": {
12+
"name": "OWASP Dependency-Check",
13+
"version": "placeholder",
14+
"rules": []
15+
}
16+
},
17+
"results": []
18+
}
19+
]
20+
}' > ./docs/reports/dependency-check-placeholder.sarif
21+
}
22+
23+
# Find all SARIF files
24+
echo "Finding SARIF files in ./docs/reports directory"
25+
find ./docs/reports -name "*.sarif" -type f
26+
27+
# Check if we have any SARIF files
28+
SARIF_COUNT=$(find ./docs/reports -name "*.sarif" -type f | wc -l)
29+
30+
if [ "$SARIF_COUNT" -eq 0 ]; then
31+
echo "No SARIF files found, creating placeholder"
32+
create_dependency_check_placeholder
33+
34+
echo "primary_sarif=./docs/reports/dependency-check-placeholder.sarif" >> $GITHUB_OUTPUT
35+
else
36+
# Get the first SARIF file for primary upload
37+
PRIMARY_SARIF=$(find ./docs/reports -name "*.sarif" -type f | head -1)
38+
echo "Found primary SARIF file: $PRIMARY_SARIF"
39+
echo "primary_sarif=$PRIMARY_SARIF" >> $GITHUB_OUTPUT
40+
fi

‎.github/workflows/scripts/generate-trufflehog-report.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
3+
# Generate TruffleHog report in docs/reports
4+
echo "Running TruffleHog scan manually to save report"
5+
docker run --rm -v $(pwd):/pwd trufflesecurity/trufflehog:latest github --repo file:///pwd --json > ./docs/reports/trufflehog-results.json || true

‎.github/workflows/scripts/process-codeql-results.sh‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#!/bin/bash
2+
3+
# Function to create placeholder SARIF file
4+
function create_placeholder_sarif() {
5+
echo '{
6+
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
7+
"version": "2.1.0",
8+
"runs": [
9+
{
10+
"tool": {
11+
"driver": {
12+
"name": "CodeQL",
13+
"version": "placeholder",
14+
"rules": []
15+
}
16+
},
17+
"results": []
18+
}
19+
]
20+
}' > ./docs/reports/codeql-results.sarif
21+
}
22+
23+
echo "Listing CodeQL SARIF files in ./docs/reports:"
24+
find ./docs/reports -type f -name "*.sarif" | sort
25+
26+
# Check if any SARIF files were generated
27+
if [ -n "$(find ./docs/reports -type f -name '*.sarif')" ]; then
28+
# Create a consolidated sarif file for DefectDojo
29+
echo "Creating consolidated SARIF file for DefectDojo"
30+
31+
# Find the first SARIF file and make a copy for DefectDojo
32+
FIRST_FILE=$(find ./docs/reports -type f -name "*.sarif" | head -1)
33+
echo "Using file: $FIRST_FILE for consolidated results"
34+
35+
# Make sure the file exists and is not a directory
36+
if [ -f "$FIRST_FILE" ]; then
37+
cp "$FIRST_FILE" ./docs/reports/codeql-results.sarif
38+
39+
# Display info about the consolidated file
40+
echo "Consolidated SARIF file created at ./docs/reports/codeql-results.sarif"
41+
ls -la ./docs/reports/codeql-results.sarif
42+
echo "First 20 lines of consolidated SARIF file:"
43+
head -n 20 ./docs/reports/codeql-results.sarif
44+
else
45+
echo "Warning: Selected file is not a regular file. Creating placeholder instead."
46+
create_placeholder_sarif
47+
fi
48+
else
49+
echo "No CodeQL SARIF files found, creating placeholder"
50+
create_placeholder_sarif
51+
fi

‎.github/workflows/scripts/save-reports.sh‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
3+
# Create comprehensive report index file
4+
echo "# DevSecOps Scan Reports" > ./docs/reports/README.md
5+
echo "Generated on $(date)" >> ./docs/reports/README.md
6+
echo "" >> ./docs/reports/README.md
7+
echo "## Available Reports" >> ./docs/reports/README.md
8+
9+
# Process all artifacts and copy to docs/reports
10+
for artifact_dir in ./artifacts/*; do
11+
if [ -d "$artifact_dir" ]; then
12+
artifact_name=$(basename "$artifact_dir")
13+
echo "Processing artifact: $artifact_name"
14+
15+
# Copy all files from the artifact directory to docs/reports
16+
cp -v $artifact_dir/* ./docs/reports/ 2>/dev/null || echo "No files to copy from $artifact_name"
17+
18+
# Add entry to the report index
19+
echo "- **$artifact_name**" >> ./docs/reports/README.md
20+
for file in $artifact_dir/*; do
21+
if [ -f "$file" ]; then
22+
filename=$(basename "$file")
23+
echo " - [$filename](./$filename)" >> ./docs/reports/README.md
24+
fi
25+
done
26+
fi
27+
done
28+
29+
# Check if any reports were saved
30+
echo "Saved reports in docs/reports directory:"
31+
ls -la ./docs/reports/

‎.github/workflows/scripts/setup-docker.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
# Check if docker-compose is available
4+
if ! command -v docker-compose &> /dev/null && ! docker compose version &> /dev/null; then
5+
echo "Installing Docker Compose plugin"
6+
# Install Docker Compose V2
7+
DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
8+
mkdir -p $DOCKER_CONFIG/cli-plugins
9+
curl -SL https://github.com/docker/compose/releases/download/v2.23.0/docker-compose-linux-x86_64 -o $DOCKER_CONFIG/cli-plugins/docker-compose
10+
chmod +x $DOCKER_CONFIG/cli-plugins/docker-compose
11+
fi
12+
13+
# Verify Docker and Docker Compose are installed
14+
echo "Docker version:"
15+
docker --version
16+
echo "Docker Compose version:"
17+
docker compose version || docker-compose --version || echo "Docker Compose not installed properly"

0 commit comments

Comments
 (0)